Time format about modsecurity-parser HOT 3 CLOSED

Hi, that's interesting.
Can you provide me your modsecurity version, log type (json/standard) and few logs - let's say 3-5 complete entries from A to Z (please of course anonymize them replacing IP/hostname). I will try to take this into account during next update.

from modsecurity-parser.

Mod_security version: mod_security-2.9.3-1.el6.x86_64
For logs nothing special, SecAuditLogType Serial

for_test.txt

Attached the file:
Tried to run the program

python3 modsecurity-parser.py -x test.xlsx -f for_test inputFileName : for_test ---------- modsec_audit events processed: 3 ---------- ---------- modsec_audit events skipped by INCLUDED/EXCLUDED options or INVALID : 0 ---------- Traceback (most recent call last): File "modsecurity-parser.py", line 689, in <module> outputWithGraphs = modsecViewGraphs(modsec_entries) File "modsecurity-parser.py", line 360, in modsecViewGraphs event_times = list(map(lambda x: datetime.strptime(x, LOG_TIMESTAMP_FORMAT).replace(tzinfo=None), event_times1)) File "modsecurity-parser.py", line 360, in <lambda> event_times = list(map(lambda x: datetime.strptime(x, LOG_TIMESTAMP_FORMAT).replace(tzinfo=None), event_times1)) File "/usr/lib64/python3.6/_strptime.py", line 565, in _strptime_datetime tt, fraction = _strptime(data_string, format) File "/usr/lib64/python3.6/_strptime.py", line 362, in _strptime (data_string, format)) ValueError: time data '10/Mar/2020:12:13:30 --0400' does not match format '%d/%b/%Y:%H:%M:%S %z'

If you replace --0400 to +0400 it works fine.

btw, the issue with the Killed action during the run was related to the amount of available ram(as expected =) )

from modsecurity-parser.

Seems that format with two dashes is very specific to Modsecurity. Anyway I added a piece of code which replaces double '-' to one and later the file is processed without any error. Check latest master and reopen if find any problems.
BTW: your example file is modified and added as 'sample_audit_log/modsec_audit_utc-4.log'.

from modsecurity-parser.